Author ： Ozgun Erdogan and Pei Cao Publisher ： IEEE Globecom 2005 (IJSN 2007) Presenter ： Zong-Lin Sie Date ： 2010/12/08 1

 This paper proposes Hash-AV, a virus scanning “booster” technique that aims to take advantage of improvements in CPU performance.  Using a set of hash functions and a bloom filter array that fits in CPU second-level (L2) caches, Hash-AV determines the majority of “no-match” cases without accesses to main memory. 2

 Using bloom filters to speed up signature matching is not a new idea [3], [19].  The key difference between those hardware solutions and our software solution is that the CPU computation cost of hash functions is not a concern in the former, but a key concern in the latter.  If the hash functions are not chosen well, computing the hashes can easily take enough CPU cycles to obliterate the advantage of cache-resident filters. 3

 The most widely used opensource anti-virus scanner  As of July 2005, it has a database of over 30,000 viruses. The database includes over 28,000 plain- text strings and over 1,300 strings with wild-card characters embedded.  The plain-text strings are for non-polymorphic viruses, and the strings with wild-card characters are for polymorphic viruses. 4

 The current version of Clam-AV uses an optimized version of the Boyer-Moore (BM) algorithm [2] for non-polymorphic signatures, and uses the Aho- Corasick (AC) algorithm [1] for polymorphic ones.  AC example ： {he,hers,his,she} 5

 Boyer Moore’s algorithm example ： 1: EXAMPLE HERE IS A SIMPLE EXAMPLE 2: EXAMPLE HERE IS A SIMPLE EXAMPLE 3: EXAMPLE HERE IS A SIMPLE EXAMPLE 4: MPLEXAMPLE HERE IS A SIMPLE EXAMPLE 6

5: EXAMPLE HERE IS A SIMPLE EXAMPLE 6: EXAMPLE HERE IS A SIMPLE EXAMPLE 7

 It aims to determine the no-match cases with high accuracy, minimal main-memory access and a small number of CPU instructions.  It achieves the goals by using a filter that fits in CPU caches and acts as a first-pass scan to determine if the data need to go through an exact match algorithm. 8

 Hash-AV constructs a bloom filter from the set of plaintext signatures. For each plain-text signature, k hash functions are applied to its first β bytes a, with results h 1 (a); h 2 (a); …; h k (a), all in the range of 1; …;N. The bits at positions h 1 (a); h 2 (a); …; h k (a) are then set to 1.  At scanning time, Hash-AV moves over the input data stream one byte at a time. For each β byte block b, the scanning algorithm applies the first hash function, h 1 (b), and checks the corresponding bit. If the bit is 1, it computes the next hash function h 2 (b); if not, it immediately goes over to the next byte 9

 In the case where all k functions have positive bloom filter matches, Hash-AV needs to check for exact match.  Two alternatives ： (1) Use Boyer-Moore. (2) Pre-construct a “secondary hash table” using the last hash function h k, with each entry holding a linked list of signatures which are checked linearly. 10

 Based on our prior experience in using bloom filters [13], k = 4 works well.  Therefore, there are three choices left in setting up Hash-AV: (1) Choosing four hash functions; (2) Choosing the size of the bloom filter; (3) Choosing β; 11

 Performance measurements over a sample executable of 120 MB, and the percentage of false positives in the filter. β is 7 and the bloom filter size is 256 KB. 12

 We then tried two really fast “hash” functions: “mask” and “xor+shift”.  “Mask” takes the first four bytes, casts them to an integer, and chooses the lowest log 2 (N) bits, where N is the size of the bloom filter.  ex ： =>

 “Xor+shift” ： Take first 6 bytes, cast byte 0-3 into an integer, and xor it with 0 to get first value. Xor 1-4 bytes with first value to get second value. Xor 2-5 bytes with second value to get final value. Then picks the lowest log 2 (N) bits.  “mask” and “xor+shift” can filter away 88% and 96% of the input bytes. However, used as first level hash functions, they can effectively cut down the number of times that the “good” hash functions are calculated by an order of magnitude.  Hash-AV contains the following four hash functions: mask, xor+shift, fast hash from hashlib.c [9] and sdbm [25]. 14

 hash(i) = hash(i - 1) * str[i]; 15

 Daniel J. Bernstein hash(i) = hash(i - 1) * 33 + str[i]; 16

 Pure Hashing Speed: (512KB L2 cache) Results peak at AMD’s second level cache size. If the filter does not fit in the cache, the cache miss latency dominates the throughput. 17

 The speed of Hash-AV on the Athlon desktop over the sample 120MB executable file.  The best filter size is mostly determined by the CPU L2 cache size. 18

 The choice of β is mainly affected by the distribution of signature lengths in the signature database.  Generally, larger βs are preferred. But (1) hash functions take more time to compute the result. Slows the algorithm down. (2) Hash-AV has to leave out short signatures.  The “xor+shift” function is designed to operate on six bytes of data, a lower limit of six is set on β. 19

 Weighting these effects of, we decided to choose β = 7 in our algorithms. 20

 We compare the throughput of Hash-AV with that of Clam- AV, using both the 30,000 signature database and the 120K signature database.  The current implementation of Hash-AV focuses on improving the scanning speed for plain-text signatures. It uses the same Aho-Corasick (AC) implementation as Clam- AV.  Three different types of inputs are used: (1) the 120MB sample executable file as described (2) a file of 99 MB containing HTML data crawled from the web (3) a 100 MB random file. 21

22

23

24

25